Privacy policy.

Last updated: 26/10/2026

This policy explains how Jimmy Garcia Catering Limited ("we", "us") collects and uses personal information about our clients, event guests, website visitors, mailing list subscribers, suppliers and visitors to our office, and the rights you have over it. Our staff, freelancers and job applicants have a separate privacy notice.

1. Who we are

Jimmy Garcia Catering Limited is the controller of your personal information. We are a company registered in England and Wales (company number 08140363), at 6-7 River Reach, Gartons Way, London SW11 3SX. We are registered with the Information Commissioner's Office (ICO), registration number ZA612681.


For anything about your personal information, contact our data protection lead at infosec@jimmygarciacatering.com or write to us at the address above.

2. What we collect and why

Enquiries and bookings. Your name, email, phone number, company and event details, so we can quote for, plan and deliver your event. Lawful basis: contract, or steps you ask us to take before entering one.


Guest dietary and allergy details. Names and dietary or allergy information for guests at events we cater, so we can serve them safely. Allergy information is health data. We use it only with explicit consent, which is usually collected by the event organiser, and share it only with the staff preparing and serving the event. Where an organiser gives us guest details for their event, we act on their instructions.


Payments. Transaction records for sales and invoices. Card payments are processed by our payment provider; we never see or store your full card details. Lawful basis: contract and legal obligation (tax and accounting records).


Mailing list. Your email address and a record of when and how you signed up, so we can send you news and offers. Lawful basis: consent. You can unsubscribe at any time using the link in every email.


Event photography. At some events we take photographs. We only use photos in which you can be identified if you have signed a release form agreeing to it. Lawful basis: consent, which you can withdraw at any time.


Website visits. Cookie identifiers, pages visited and approximate location. Essential cookies keep the site working; analytics cookies are used only if you accept them. Lawful basis: consent for analytics; legitimate interests for essential cookies.


Suppliers. Contact and bank details for the people we buy from. Lawful basis: contract and legal obligation.


Office CCTV. Images of people visiting our office, recorded for security. Signs show where cameras operate. Lawful basis: legitimate interests in keeping our premises, people and property safe.

3. Who we share it with

We do not sell your personal information or share it with third parties for their own marketing. We use trusted service providers who process it on our behalf under contract: email and file storage, accounting, mailing list, till and card payment, event management, table booking and ticketing, website hosting and website analytics providers. A list of the providers we use is available on request.


We also share information with our accountant, with HMRC where the law requires, with an event's organiser where it relates to that event, and with the police or other authorities where we are legally required to.

4. Transfers outside the UK

Some of our providers, including Google, Mailchimp and Xero, may process information outside the UK. Where they do, the transfer is protected by UK adequacy regulations, including the UK-US data bridge for certified US companies, or by the ICO's approved transfer contract terms.

5. How long we keep it

  • Enquiries, bookings and payment records: a minimum of 6 years, for tax and legal claims.

  • Guest dietary and allergy details: 3 years after the event.

  • Event photographs: until you withdraw your consent.

  • Mailing list: until you unsubscribe.

  • Website analytics: 14 months.

  • Supplier records: a minimum of 6 years.

  • CCTV footage: 30 days, unless it is needed to investigate an incident.

6. Your rights

You have the right to:


  • ask for a copy of the personal information we hold about you;

  • ask us to correct anything that is wrong or incomplete;

  • ask us to delete your information;

  • ask us to restrict how we use it;

  • object to how we use it, including at any time to marketing;

  • ask for a copy in a portable format, or for us to send it to another organisation;

  • withdraw your consent at any time, where we rely on it.


To use any of these rights, email infosec@jimmygarciacatering.com. There is no charge. We may ask you to confirm your identity, and we will respond within one month.


If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the ICO at ico.org.uk or on 0303 123 1113.

7. Cookies

Our website uses essential cookies to work. We use analytics cookies only if you accept them in our cookie banner, and you can change your choice at any time. You can also block cookies in your browser settings.

8. Changes to this policy

We review this policy at least once a year. The date at the top shows when it was last updated.